CVE-2012-2378

CVE-2012-2378 describes a vulnerability in Apache CXF versions 2.4.5-2.4.7, 2.5.1-2.5.3, and 2.6.x prior to 2.6.1, where the client-side enforcement of WS-SecurityPolicy 1.1 SupportingToken child policies is insufficient. This allows remote attackers to bypass critical security policies such as AlgorithmSuite, SignedParts, and EncryptedParts. Rated with a CVSS score of 4.3 (Medium), this vulnerability has a network attack vector, medium complexity, and could lead to partial confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.